Slashdot Mirror
US Government Can't Get Controversial Kaspersky Lab Software Off Its Networks (thedailybeast.com)
The law says American agencies must eliminate the use of Kaspersky Lab software by October. But U.S. officials say that's impossible as the security suite is embedded too deep in our infrastructure, The Daily Beast reported Wednesday. From a report: Multiple divisions of the U.S. government are confronting the reality that code written by the Moscow-based security company is embedded deep within American infrastructure, in routers, firewalls, and other hardware -- and nobody is certain how to get rid of it. "It's messy, and it's going to take way longer than a year," said one U.S. official. "Congress didn't give anyone money to replace these devices, and the budget had no wiggle-room to begin with."
At issue is a provision of the National Defense Authorization Act (NDAA) enacted last December that requires the government to fully purge itself of "any hardware, software, or services developed or provided, in whole or in part," by Kaspersky Lab. The law was a dramatic expansion of an earlier DHS directive that only outlawed "Kaspersky-branded" products. Both measures came after months of saber rattling by the U.S., which has grown increasingly anxious about Kaspersky's presence in federal networks in the wake of Russia's 2016 election interference campaign.
At issue is a provision of the National Defense Authorization Act (NDAA) enacted last December that requires the government to fully purge itself of "any hardware, software, or services developed or provided, in whole or in part," by Kaspersky Lab. The law was a dramatic expansion of an earlier DHS directive that only outlawed "Kaspersky-branded" products. Both measures came after months of saber rattling by the U.S., which has grown increasingly anxious about Kaspersky's presence in federal networks in the wake of Russia's 2016 election interference campaign.
We must read the story of Helen of Troy, and the Trojan horse. Most bolshy applicable.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
~20 years of NSA infiltrating network components, who would have expect the other side to do the same...
There still has not been any proof or even shady evidence offered that Russia changed a single ballot or tampered with a single voting machine, or had agents at a single polling place to interfere with the election process..
Exercising the right of free speech in order to influence the way people think is called "politics," not "interfering with an election."
Foreign interests have "interfered" with our elections since the birth of the nation. It's nothing new. Get over yourselves.
Al is looking into it. (He prefers Alphonse, BTW) He said the Kapersky shit is like Norton and is a bitch to get off of the machines.
It'd be best to just trash the machines and start with all new ones.
Alphonse knows a guy who knows a guy who can get really cheap machines. His name is Wong Wei Wang. His company is based in Beijing and is called (English translation) Friendly Not Government Controlled Computer Company. The Trump administration has already OKay'd it. Eric is such a great guy according to Wong.
The question to ask, as both a taxpayer and an IT guy is this: What's the "penalty" for failing to make the October deadline?
Awk! Pieces of eight. Pieces of eight. Pieces of seven... ERROR: General Protection Fault. [Paroty Error.]
Wondering if they'll replace it with TrendMicro, because that would be so much more secure....
But the question is, who is a Russian? I propose defining that anyone with more than one grandparent of Russian blood is to be considered a Russian. For personnel for high-security duties, no ancestors since 1750 may be Russian.
All Russians are white, too. You'd better avoid the Chinese as well, as both of these countries are economically hostile against the US. Thus, no whites or asians may be allowed for any trusted jobs. Also, as neither Russia nor China recognizes genders which don't exist in nature, you can avoid all such spies by disallowing males and females who identify as their birth gender. See, and the rightards claim that tech companies partake in racial and gender discrimination for no rational reason!
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
The government is lucky this Kaspersky scare is bullshit, then. If this had been an actual emergency (e.g. the software were doing something bad, whether by design or due to some random bug that you can't fix because it's proprietary), sounds like everything would be totally fucked.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
If you can't get your Anti-Virus software off of your equipment, is it really anti-virus, or has it just become another virus?
Brawndo: It's what plants crave!
Fuck it then, just ban ALL people from contributing to proprietary software like Windows. Demand open source hardware and software.
Oh but we needs Windows for games!
No, you don't. What you're a slave of is DirectX.
bullshit. Do a week of training with one of their competitors, uninstall the old stuff, install the new stuff, call it a day. None of this is difficult. These are software programs designed to take care of security for end users.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
>> Congress didn't give anyone money to replace these devices, and the budget had no wiggle-room to begin with
In the real world, I'd go to Kaspersky's biggest competitors and say, "if you replace these guys on a one-to-one basis (at no charge this year), we'll give you their support contracts in future years."
A government agency with no slack in their budget? Inability to remove third party software because it's embedded too deeply? This has all the look and feel of another tax payer shakedown.
I don't believe in karma, I just call it like I see it.
Yep. Ask Sony music CDs.
https://en.wikipedia.org/wiki/...
Same as other racists, your problem is that you asked "who" instead of "what."
Instead of trying to classify the people, instead the useful question is: What is Russia? And what therefore amounts to Russian control of a non-Russian network resource?
It may turn out to be an issue between nation-states, not an issue between individuals at all. And it may actually be very easy to tell US Government property from Russian Government property!
Same as other racists, your problem is that you asked "who" instead of "what."
Excuse me, please tell me how could I write my post in a tone even more mocking?
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
"We thought it was just the White House computers crawling with stuff helpful to Putin but it's worse than we thought!"
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
From the summary: "Congress didn't give anyone money to replace these devices, and the budget had no wiggle-room to begin with."
I hope the U.S. will eventually have a healthy government.
The parent comment: "~20 years of NSA infiltrating network components, who would have expected the other side to do the same...?" (Slightly edited.)
"National Security is the chief cause of national insecurity." - Celine's First Law.
Life in the U.S. is rapidly degrading.
Step 1 in using Linux in an environment beyond your personal use: Make all those decisions for the users.
Step 2: Recognize that making 22 million people take even a 1 hour class (let alone "6 month") is a cost of more than half a billion dollars. Therefore, anything you can do to make it easier to learn is worth doing.
Your ad here. Ask me how!
LoL, it's called "uninstall".
:)
Of course, if you're still afraid they left some kind of spyware, then just Nuke & Pave.
Tossing the hardware because you can't figure out how to use an uninstall something is only a solution for a rich moron that's a complete computer illiterate.
Sure a bunch of the higher ups more or less fit that category, but it's not like they're the ones that'll be doing any of it in the first place.
For that matter, even if they buy new hardware, it'll still have to be configured and have the appropriate software installed on it, so it's no more work for IT than doing a nuke & pave. Besides, it'll take more time and a lot more money to get that unneeded replacement hardware.
However, if they do go full moron and buy new hardware, please send the old ones to me.
it's a bloody national security issue. Get the money for new hardware out of the Defense budget. There's no shortage of money there.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Are trying to some how say those same 22 million people aren't wasting at least an hour or more a week on unofficial breaks and chat sessions? Just think of the inefficiencies!!! If the environment was setup correctly, with limited but specific programs needed to get the job done, then most people would do fine on most any operating system. This is especially true if you spend most of your time in a web browser or specific application for most of your work. At my work MS office, outlook and IE are pretty much the only tools we use outside of a two legacy applications that run on SCO (shudders) hardware, in which case we ssh into those. Ironic it is SCO but at least we got some linux running at work.
It was definitely of interest during the (first) Cold War if you had relatives or ancestors the other side of the Iron Curtain and you applied for a government or other potentially sensitive job. A relative of mine lost his job as a pilot because his brother was living in the West.
Family members are still used by ruthless regimes to put pressure on those otherwise out of reach so despite your exaggeration, it's a valid concern.
... on a quantum computer.
It little behooves the best of us to comment on the rest of us.
... compared to removing Avast.
It little behooves the best of us to comment on the rest of us.
You were mocking???
Disclaimer:
Englishmen never tell the truth! I should know, as I am an Englishman.
The US government using Russian-made software to secure their machines is like the time that they let Russian workers build the Moscow embassy. It ended up being so bug-ridden that they had to rebuild parts of the new building in order to have a secure zone.
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
With the rapid advancements in AI, it doesn't seem that this problem should be too hard to resolve.
Wasn't that the plot of Terminator 3?
... on a quantum computer.
A 3D-printed quantum computer.
Just cruising through this digital world at 33 1/3 rpm...
Even if there's a firmware backdoor, it depends on how it interacts with the running OS...
If it's totally independent then it can still do its thing, but then it's somewhat limited in what exactly it can do. If it's aware of the OS then it can be far more effective, but is also likely to break if the OS is significantly changed.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
For most use cases, a change to linux will be a minor adjustment to the UI - if they even notice at all, and depending on which UI they were using previously, and which UI you choose to run on top of linux.
There are also significant differences between windows xp/7/8/10, as well as various applications they might have been using, switching to a newer version of windows and msoffice can be as big of a change for many users as switching to linux.
Most of those users are probably already using linux in one form or another (chromeos, android, embedded).
Most users don't actually care what they're running, and will use whatever they're given. They will complain about change - whatever the change might be, and after a while they'll get used to it and get on with their jobs.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
What "rapid advancement"? No such thing is happening. It is still the same dumb automation that was available 30 years ago, just a lot faster and cheaper. It is not suitable to solve the malware problem as that is not a question of speed.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Don't think there are backdoors in Asian chips and boards?
Don't think there are other vulnerabilities put into software outsourced to India, China or Eastern Europe?
If so, you're an idiot, or just possibly a naive, uninformed, incompetent military/security timeserver more concerned with saving money and getting a good review than with actual national security.
Or maybe you're just stupid enough to trust our silicon valley overlords who do the actual outsourcing. I'm sure they give a shit about national security over profit.
Just a thought.
Please do not read this sig. Thank you.
Oh, a conversion is possible, for sure. But the OP was saying "just have them learn Linux, then choose an office suite, and then..." The right way to approach it is to produce one highly unified official distro, with all those decisions made. Hide most of the changes underneath a easy-to-use GUI. Get help staff ready, etc.
Although, your point about "already running Linux" is disingenuous. While ChromeOS, Android and embedded systems may all run Linux, none of them feel like linux. Most Android users cannot access the filesystem, ChromeOS is essentially booting directly into Chrome and SSHing into an embedded system has probably been 0 peoples way of learning Linux (highly technically people moving to Linux aside.)
Your ad here. Ask me how!
Let's rephrase:
With the rapid advancements in AI jargon and AI-related rhetoric by Silicon Valley startups in pursuit lucrative venture capital and it doesn't seem that this problem should be too hard to resolve.
Are trying to some how say those same 22 million people aren't wasting at least an hour or more a week on unofficial breaks and chat sessions?
And they would just stop doing that if they were switched to Linux? If it were so easy to get rid of inefficiencies, it would have been done already.
When software is tested the testing should include the ease of a full uninstall, plus some regression testing to be sure the uninstall didn't have side effects. I stopped buying Logitech products about 15 years ago when one uninstall had side effects that took me 8 hours to fix.